🙂 Okay, I think I have it: | rex "Name\:\s(?<NAME>.[^\n]+)\nSummary\:\s(?<SUM>.[^\n]+)\nDescription\:\s(?<DES>(?:\s|.)*?(?=Category))Category\:\s(?<CAT>.[^\n]+)\nState\:\s(?<STATE>.[^\n]+)\nPublisher\:\s(?<PUB>.[^\n]+)\nVersion\:\s(?<VER>.[^\n]+)\nBuild\sRelease\:(?<BUILD>.[^\n]+)\nBranch\:\s(?<BRANCH>.[^\n]+)\nPackaging\sDate\:(?<PDATE>.[^\n]+)\nSize\:(?<SIZE>.[^\n]+)\nFMRI\:\s(?<FMRI>.[^\n]+)" Let me know if there are issues. ... View more

Hello @abhi04, so here is an updated regex: | rex "Name\:\s(?<NAME>.[^\n]+)\nSummary\:\s(?<SUM>.[^\n]+)\nDescription\:\s(?<DES>.+\n.+\n.+\n.+\n.+)\nCategory\:\s(?<CAT>.[^\n]+)\nState\:\s(?<STATE>.[^\n]+)\nPublisher\:\s(?<PUB>.[^\n]+)\nVersion\:\s(?<VER>.[^\n]+)\nBuild\sRelease\:(?<BUILD>.[^\n]+)\nBranch\:\s(?<BRANCH>.[^\n]+)\nPackaging\sDate\:(?<PDATE>.[^\n]+)\nSize\:(?<SIZE>.[^\n]+)\nFMRI\:\s(?<FMRI>.[^\n]+)" Assuming the number of line breaks remains the same, the above will work. If it varies on each event we will need to come up with another plan for the Description field. In the DES line each "\n" is a line break or carriage return. If the DES field varies we may need to figure out a way to do some OR "|" lookups. ... View more

Try this: | rex field=sender "@(?<domain>.[^\>]+)" ... View more

Not real sure which part you are trying to capture, but here is what I came up with: | rex "java\.util\.concurrent\.Exception\:\s(?<CODE>.[^\;]+)\;\sException\:(?<EXCEPTION>.[^\:]+)\:\s\{\s(?<MSG>.[^\}]+)" Let me know if you need more. ... View more

Hmm.. sorry I do not have any other ideas here... ... View more

Sorry I missed that earlier. Here is what I came up with: search | rex "(?<P1>Name\:)\s(?<NAME>.[^\n]+)\s(?<P2>Summary\:)\s(?<SUM>.[^\n]+)\s(?<P3>Description\:)\s(?<DES>.[^\.]+)\.\s(?<P4>Category\:)\s(?<CAT>.[^\n]+)\s(?<P5>State\:)\s(?<STATE>.[^\n]+)\s(?<P6>Publisher\:)\s(?<PUB>.[^\n]+)\s(?<P7>Version\:)\s(?<VER>.[^\n]+)\s(?<P8>Build\sRelease\:)\s(?<BUILD>.[^\n]+)\s(?<P9>Branch\:)\s(?<BRANCH>.[^\n]+)\s(?<P10>Packaging\sDate\:)\s(?<PDATE>.[^\n]+)\s(?<P11>Size\:)\s(?<SIZE>.[^\n]+)\s(?<P12>FMRI\:)\s(?<FMRI>.[^\n]+)" | table P1 NAME P2 SUM P3 DES P4 CAT P5 STATE P6 PUB P7 VER P8 BUILD P9 BRANCH P10 PDATE P11 SIZE P12 FMRI ... View more

Assuming the event will have the same formatting as above: search | rex "Name\:\s(?<NAME>.[^\n]+)\sSummary\:\s(?<SUM>.[^\n]+)\sDescription\:\s(?<DES>.[^\.]+)\.\sCategory\:\s(?<CAT>.[^\n]+)\sState\:\s(?<STATE>.[^\n]+)\sPublisher\:\s(?<PUB>.[^\n]+)\sVersion\:\s(?<VER>.[^\n]+)\sBuild\sRelease\:(?<BUILD>.[^\n]+)\sBranch\:\s(?<BRANCH>.[^\n]+)\sPackaging\sDate\:(?<PDATE>.[^\n]+)\sSize\:(?<SIZE>.[^\n]+)\sFMRI\:\s(?<FMRI>.[^\n]+)" | table NAME SUM DES CAT STATE PUB VER BUILD BRANCH PDATE FMRI Let us know if you need more. ... View more

Alerts and Reports have their own permissions. When you create one you will need to set the permission even if the user has access to the index. ... View more

Ah, I would change the search time to be only last 60 minutes or few hours. Like you are seeing, since you are looking back 24 hours it is going to return any other alerts triggered in the last 24 hours. ... View more

Set the token as "*" and it will still run and return results. ... View more

When you configure the Alert you can select "Throttle" and then you can say how long to not notify you. Hope this helps. Let us know if you need more. ... View more

And, if you are only trying to capture the WHERE: | rex "where\s(?<WHERECAPTURE>.*)\s" ... View more

I agree with dflodstrom, if the IP address is not being placed into a field already, you can use rex to do it: | rex "info\slogger:\s[.[^]]+][.[^]]+]\s(? .[^\s]+)" | table source host host_ip ... View more

hmm... my bad, normally the developer places contact info on the page, but I cannot find any... ... View more

According to Splunk base, the app is for Splunk 6.2. You may want to contact the creator and see if it will work with 6.6 and they may be able to provide some help. ... View more

Here is a screen shot: ... View more

Under Reports, find the report you are using for the dashboard. Click the Edit drop down, then Edit Permissions. Be sure to set the Read to Everyone, or whatever role system you might be using. ... View more

Be sure the pdf has the correct permissions. A scheduled report has permissions different from the dashboard. ... View more

Hello drbruhn, something like this should work: user="*" computername="*" comment="Backup*" stats count(comment) by comment, user ... View more

Hello, could you provide a sample event? ... View more

I used to be our DUO Admin but have moved on. In the DUO Telephony log you should be able to look for Enrollment to key on users being added. We are not getting the DUO logs into Splunk so I can't really provide more than ideas 🙂 ... View more

Excellent. My guess is you may be able to use your SSO application logs (cas, shib, etc) to get IP and USERID as well as other info. As for the User being created in DUO, unless you have the DUO logs being pumped into Splunk you may not be able to see that. Depending on your process for adding users into DUO you may be able to get the info in another way. When we rolled DUO out for our Students we used the DUO API and created an intercept for Users not already in DUO. The User would SSO auth, then the app would use the API to check DUO to see if the User was in DUO. If not, they would then be given the option to create their account. We would then push the data from our system to DUO and would use the success from that to count the users added to DUO. Hope this helps. ... View more

Hey nathant27, what is it you are using DUO for? I am using DUO for Peoplesoft MFA and look to the values in my PS logs for the DUO hits. Depending on what application you are using DUO for you may be able to look to those logs. ... View more

Hey brdr, I think the issue may be that you have the base search in a panel. I think it need to be outside the panel: https://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/Buildandeditforms ... View more